AKS环境下Helm升级cert-manager失败问题求助

问题概述 #

部署在AKS 1.27.7上的cert-manager v0.13.0出现ca-injector CrashLoopBackOff，原因是K8s 1.22+已废弃admissionregistration.k8s.io/v1beta1和rbac.authorization.k8s.io/v1beta1 API版本，而旧版cert-manager依赖这些废弃API。尝试直接升级到v1.11.5时，Helm因无法识别旧版本API资源而报错。

版本信息 #

• Helm版本：3.9.3
• cert-manager版本：0.13.0
• AKS版本：1.27.7

当前状态 #

cert-manager命名空间Pod状态：

NAME                      READY   UP-TO-DATE   AVAILABLE 
cert-manager              1/1     1            1           
cert-manager-cainjector   0/1     1            0          
cert-manager-webhook      1/1     1            1           

ca-injector日志报错：

1 start.go:82] starting ca-injector v0.13.0 (revision 6d9200f9d)
1 start.go:147] error registering core-only controllers: no matches for kind "MutatingWebhookConfiguration" in version "admissionregistration.k8s.io/v1beta1"

ca-injector Pod关键状态：

State:          Waiting
  Reason:       CrashLoopBackOff
Last State:     Terminated
  Reason:       Error
  Exit Code:    255
Restart Count:  10
Events:
  Warning  BackOff    73s (x139 over 31m)  kubelet            Back-off restarting failed container cert-manager in pod cert-manager-cainjector_cert-manager(..)

已尝试操作 #

执行Helm升级命令：

helm upgrade cert-manager jetstack/cert-manager --namespace cert-manager --set installCRDs=true --set version=1.11.5

核心报错（无法识别v1beta1版本的RBAC和Webhook资源）：

Error: UPGRADE FAILED: unable to build kubernetes objects from current release manifest: [resource mapping not found for name: "cert-manager-cainjector" namespace: "" from "": no matches for kind "ClusterRole" in version "rbac.authorization.k8s.io/v1beta1"
...（省略重复错误）
resource mapping not found for name: "cert-manager-webhook" namespace: "" from "": no matches for kind "ValidatingWebhookConfiguration" in version "admissionregistration.k8s.io/v1beta1"
ensure CRDs are installed first]

已确认现有CRD已升级到v1版本，但升级仍失败。

解决方案建议 #

步骤1：备份关键资源 #

先备份cert-manager自定义资源，避免数据丢失：

# 备份所有证书
kubectl get certificates --all-namespaces -o yaml > certs-backup.yaml
# 备份所有命名空间级Issuer
kubectl get issuers --all-namespaces -o yaml > issuers-backup.yaml
# 备份集群级ClusterIssuer
kubectl get clusterissuers -o yaml > clusterissuers-backup.yaml

步骤2：卸载旧版cert-manager（保留自定义资源） #

卸载Helm release，默认不会删除CRD和证书、Issuer等自定义资源：

helm uninstall cert-manager --namespace cert-manager

步骤3：清理废弃的v1beta1资源 #

手动删除旧版本遗留的、K8s 1.27不支持的v1beta1版本资源：

# 删除旧ClusterRole
kubectl delete clusterrole cert-manager-cainjector cert-manager-controller-issuers cert-manager-controller-clusterissuers cert-manager-controller-certificates cert-manager-controller-orders cert-manager-controller-challenges cert-manager-controller-ingress-shim
# 删除旧ClusterRoleBinding
kubectl delete clusterrolebinding cert-manager-cainjector cert-manager-controller-issuers cert-manager-controller-clusterissuers cert-manager-controller-certificates cert-manager-controller-orders cert-manager-controller-challenges cert-manager-controller-ingress-shim cert-manager-webhook:auth-delegator
# 删除kube-system下的旧Role和RoleBinding
kubectl delete role -n kube-system cert-manager-cainjector:leaderelection cert-manager:leaderelection
kubectl delete rolebinding -n kube-system cert-manager-cainjector:leaderelection cert-manager:leaderelection cert-manager-webhook:webhook-authentication-reader
# 删除旧Webhook配置
kubectl delete mutatingwebhookconfiguration cert-manager-webhook
kubectl delete validatingwebhookconfiguration cert-manager-webhook

步骤4：安装兼容AKS 1.27的cert-manager版本 #

选择与AKS 1.27兼容的cert-manager版本（推荐v1.13.x及以上，此处以v1.13.0为例）：

# 添加Jetstack Helm仓库
helm repo add jetstack https://charts.jetstack.io
helm repo update

# 先安装cert-manager CRD
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.crds.yaml

# 安装cert-manager
helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --version v1.13.0

步骤5：恢复备份资源 #

kubectl apply -f certs-backup.yaml
kubectl apply -f issuers-backup.yaml
kubectl apply -f clusterissuers-backup.yaml

步骤6：验证部署状态 #

# 检查cert-manager Pod是否全部就绪
kubectl get pods -n cert-manager
# 检查证书状态是否正常
kubectl get certificates --all-namespaces

关键说明 #

• 不要直接删除cert-manager的CRD，否则会连带删除所有证书、Issuer等自定义资源，导致服务中断。
• AKS 1.27已完全移除v1beta1版本的RBAC和AdmissionRegistration API，必须使用支持v1 API的cert-manager版本（v1.6+开始支持v1 API，推荐使用v1.10+以兼容最新K8s版本）。

内容的提问来源于stack exchange，提问作者soappanda